In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-dovecot | Aug 22, 2024 | Aug 29, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-dovecotamazon-linux-ami-2-upgrade-dovecot-debuginfoamazon-linux-ami-2-upgrade-dovecot-develamazon-linux-ami-2-upgrade-dovecot-mysqlamazon-linux-ami-2-upgrade-dovecot-pgsqlamazon-linux-ami-2-upgrade-dovecot-pigeonhole | Apr 27, 2020 | Aug 29, 2019 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Aug 29, 2019 | |
| Centos_linux | — | centos-upgrade-dovecotcentos-upgrade-dovecot-debuginfocentos-upgrade-dovecot-debugsourcecentos-upgrade-dovecot-develcentos-upgrade-dovecot-mysqlcentos-upgrade-dovecot-mysql-debuginfocentos-upgrade-dovecot-pgsqlcentos-upgrade-dovecot-pgsql-debuginfocentos-upgrade-dovecot-pigeonholecentos-upgrade-dovecot-pigeonhole-debuginfo | Sep 23, 2019 | Aug 29, 2019 |
| Debian | debian-upgrade-dovecot | Aug 30, 2019 | Aug 30, 2019 | |
| Freebsd | freebsd-upgrade-package-dovecotfreebsd-upgrade-package-dovecot-pigeonhole | Aug 29, 2019 | Aug 28, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-net-mail-dovecot | Sep 3, 2019 | Aug 29, 2019 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-dovecothuawei-euleros-2_0_sp2-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp2-upgrade-dovecot-pgsqlhuawei-euleros-2_0_sp2-upgrade-dovecot-pigeonhole | Dec 4, 2019 | Aug 29, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-dovecothuawei-euleros-2_0_sp3-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp3-upgrade-dovecot-pgsqlhuawei-euleros-2_0_sp3-upgrade-dovecot-pigeonhole | Nov 19, 2019 | Aug 29, 2019 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-dovecothuawei-euleros-2_0_sp5-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp5-upgrade-dovecot-pgsqlhuawei-euleros-2_0_sp5-upgrade-dovecot-pigeonhole | Nov 19, 2019 | Aug 29, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-dovecothuawei-euleros-2_0_sp8-upgrade-dovecot-mysqlhuawei-euleros-2_0_sp8-upgrade-dovecot-pigeonhole | Sep 30, 2019 | Aug 29, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-dovecotoracle-linux-upgrade-dovecot-develoracle-linux-upgrade-dovecot-mysqloracle-linux-upgrade-dovecot-pgsqloracle-linux-upgrade-dovecot-pigeonhole | Sep 21, 2019 | Aug 28, 2019 |
| Redhat_linux | redhat-upgrade-dovecotredhat-upgrade-dovecot-debuginforedhat-upgrade-dovecot-debugsourceredhat-upgrade-dovecot-develredhat-upgrade-dovecot-mysqlredhat-upgrade-dovecot-mysql-debuginforedhat-upgrade-dovecot-pgsqlredhat-upgrade-dovecot-pgsql-debuginforedhat-upgrade-dovecot-pigeonholeredhat-upgrade-dovecot-pigeonhole-debuginfo | Sep 23, 2019 | Aug 29, 2019 | |
| Suse | — | suse-upgrade-dovecot22suse-upgrade-dovecot22-backend-mysqlsuse-upgrade-dovecot22-backend-pgsqlsuse-upgrade-dovecot22-backend-sqlitesuse-upgrade-dovecot22-develsuse-upgrade-dovecot23suse-upgrade-dovecot23-backend-mysqlsuse-upgrade-dovecot23-backend-pgsqlsuse-upgrade-dovecot23-backend-sqlitesuse-upgrade-dovecot23-develsuse-upgrade-dovecot23-ftssuse-upgrade-dovecot23-fts-lucenesuse-upgrade-dovecot23-fts-solrsuse-upgrade-dovecot23-fts-squat | Sep 25, 2019 | Aug 28, 2019 |
| Ubuntu | ubuntu-pro-upgrade-dovecot-coreubuntu-upgrade-dovecot-core | Aug 29, 2019 | Aug 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub